Privacy Policy – YachtSecure
Last updated: October 2026
1. Introduction and data controller
FROLSON, publisher of the YachtSecure platform (website www.yachtsecure.com, client portal and mobile application), is committed to protecting the privacy and personal data of its users. This policy explains how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French law.
Data controller: FROLSON (Y.I FROLSON), SARL – 45 avenue Pasteur, 06600 Antibes, France – SIRET 810 629 147 00036 – ORIAS 15003012
Data protection contact: Guillaume Grunberg – privacy@frolson.com
Delete your account: see section 9 – Delete your YachtSecure account and data.
2. Personal data we collect
2.1 Data you provide
- Account: first and last name, email address, phone number, country of residence.
- Vessel: name, type and technical characteristics (length, year of build, builder, model), insured value, home port, navigation area, IMO number or registration where applicable.
- Insurance documents: policies, quotes, contracts and endorsements, certificates, claim files and correspondence with insurers.
- Messages with the AI assistant “Yachtie” and, if you use voice dictation, the transcription of your voice.
2.2 Data collected automatically
- Connection data: IP address, browser and operating system, pages visited, date and time of connection, approximate location derived from the IP address.
- Cookies: session and authentication cookies, preference cookies, and analytics cookies (Google Analytics with IP anonymisation) subject to your consent.
- Mobile app: notification token (to send you notifications).
2.3 Location (mobile app)
Your device location is used only when you request it, to sort marinas by distance and to identify the competent maritime rescue centre in the SOS tab. It is not used in the background and is not used to build a history of your movements. You can disable it at any time in your device settings.
3. Purposes and legal bases
| Purpose | Legal basis | Data concerned |
|---|---|---|
| Creating and managing your account | Performance of contract | Identification data, email |
| Insurance brokerage, analysis of your contracts | Performance of contract | Insurance documents, vessel data, analysis results |
| AI assistant “Yachtie” | Performance of contract and consent (Art. 6.1.a and b GDPR) | Messages, insurance file, voice transcriptions |
| Automated analysis of uploaded documents | Explicit consent | Uploaded documents, extracted content |
| Communication with you (support, notifications) | Performance of contract / legitimate interest | Email, phone, notification token, interaction history |
| Service improvement | Legitimate interest | Usage data, feedback |
| Audience statistics (Google Analytics) | Consent (cookies) | Anonymised browsing data |
| Security and fraud prevention | Legitimate interest / legal obligation | Connection logs, IP address |
| Legal obligations (accounting, anti-money laundering) | Legal obligation | Contracts, identity, invoices |
4. Artificial intelligence
4.1 The AI assistant “Yachtie”
The YachtSecure app and portal include a conversational assistant, Yachtie, which answers questions about your insurance contracts, prepares your requests (contract changes, document requests) and guides you through claim declarations. Its answers are indicative and do not replace the advice of our brokers. You accept the assistant’s terms of use before using it for the first time.
4.2 Where your data is processed
Your insurance file and your personal data are processed by our own artificial intelligence models, hosted on our own servers in France. They are not entrusted to any third-party host.
4.3 Analysis of policy wording by a third-party service
To analyse the general and special conditions of your contracts, we use a third-party artificial intelligence provider (professional plan). Before any request, the information is pseudonymised on our servers: your name, names of persons, dates of birth, contact details and policy numbers, as well as the identity of your vessel (name, shipyard, model, flag, registration numbers) are removed or replaced with fictitious values, and restored only in the answer displayed to you. Only the technical characteristics needed to apply the policy terms (vessel type, hull material, length, age, speed, use) are transmitted. The provider does not use this data to train its models.
4.4 Voice dictation
Speech recognition is performed on your device whenever possible. Otherwise, we ask for your consent before using your system’s speech recognition service (Apple or Google). No audio recording is sent to our servers.
4.5 No solely automated decisions
FROLSON does not make decisions producing legal effects based solely on automated processing. You can always request human intervention from one of our brokers or contest a result.
5. Recipients and subprocessors
Your data is accessible only to authorised FROLSON staff (technical team, client service, management). We use the following subprocessors, all bound by GDPR-compliant agreements:
| Provider | Purpose | Location / safeguards |
|---|---|---|
| FROLSON’s own servers | Application, database and internal AI models | France (no third-party host) |
| Hostinger International Ltd. | Hosting of the website yachtsecure.com | France (Paris) |
| Third-party AI provider (professional plan) | Analysis of policy wording on pseudonymised data only; no reuse for model training | European Union, or a country covered by an adequacy decision (including the EU-US Data Privacy Framework), otherwise standard contractual clauses |
| Google (Firebase Cloud Messaging) | Push notifications | EU / USA – EU-US Data Privacy Framework, standard contractual clauses |
| Apple | Sign in with Apple, iOS notifications, voice dictation (if accepted) | EU / USA – EU-US Data Privacy Framework, standard contractual clauses |
| Google (Google Sign-In) | Sign-in with a Google account | EU / USA – EU-US Data Privacy Framework, standard contractual clauses |
| Microsoft | Sign-in with a Microsoft account | EU / USA – EU-US Data Privacy Framework, standard contractual clauses |
| Google (Google Analytics) | Audience statistics, with your consent | EU / USA – EU-US Data Privacy Framework, standard contractual clauses |
The complete list of our subprocessors, by name, is available on request at privacy@frolson.com. FROLSON never sells or rents your personal data.
6. Transfers outside the European Union
Your insurance documents and identifying data processed by our own servers remain in the European Union. Where auxiliary third-party services (sign-in, notifications, analytics, analysis of pseudonymised policy wording) involve transfers outside the EU, they are governed by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
7. Retention periods
| Data | Retention period | Reference |
|---|---|---|
| Conversation history with Yachtie | Automatically deleted after 30 days, including after account deletion | Consent / performance of contract |
| Insurance file (requests, quotes, contracts, claims) | Duration of the contractual relationship, then 2 years | Art. L114-1 French Insurance Code |
| Anti-money laundering records | 5 years after the end of the business relationship | Art. L561-12 French Monetary and Financial Code |
| Active account | Duration of the contractual relationship | Performance of contract |
| Closed account (general data) | 3 years after closure | Limitation period |
| Connection logs | 12 months maximum | Legal obligation (security) |
| Invoices and accounting records | 10 years | Accounting obligation |
| Analytics cookies | 13 months maximum | Consent |
At the end of these periods, your data is permanently deleted or irreversibly anonymised.
8. Security
We apply encryption in transit (HTTPS/TLS), AES-256 encryption at rest, bcrypt password hashing, strict least-privilege access control, multi-factor authentication for administrators, daily encrypted backups and 24/7 monitoring of our infrastructure. In the event of a data breach presenting a high risk to your rights, we notify the CNIL within 72 hours and inform the persons concerned.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time. You can also give instructions regarding your data after your death.
Delete your YachtSecure account and data
You can ask FROLSON, publisher of the YachtSecure app, to delete your account and the associated data in either of these ways:
- In the app or the client portal: go to Settings > Delete my account, then confirm.
- Without the app: send an email to privacy@frolson.com with the subject “Delete my account”, from the email address linked to your account. We process your request within one month and confirm by email.
Data deleted: your account, profile and sign-in data are deleted immediately; your conversation history with the AI assistant is deleted within 30 days at most.
Data retained: insurance contract and claim data, anti-money laundering records and accounting records are kept only for the periods required by law (see section 7), then permanently deleted.
Exercising your rights: email privacy@frolson.com or write to FROLSON, 45 avenue Pasteur, 06600 Antibes, France. We reply within one month.
Complaint: you may lodge a complaint with the CNIL (www.cnil.fr – 3 Place de Fontenoy, 75334 Paris Cedex 07, France).
10. Cookies
We use strictly necessary cookies (authentication, security) and preference cookies. Analytics cookies (Google Analytics with IP anonymisation) are only set with your prior consent via the cookie banner. You can change your choices at any time.
11. Sign-in with a third-party account
If you sign in with Apple, Google or Microsoft, we only receive your name and email address. We never publish anything on your external accounts.
12. Minors
Our services are reserved for persons aged 18 and over. If you believe a minor has provided us with data, contact us at privacy@frolson.com so that we can delete it.
13. Changes to this policy
We may update this policy to reflect changes to our services or to regulations. Significant changes will be brought to your attention on the website or in the app.
14. Contact
FROLSON – 45 avenue Pasteur, 06600 Antibes, France – privacy@frolson.com
This policy complements our Legal Notice and our Terms of Service.
